HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

Akin HTTP request fingerprint

a11cun030_00000049_54d07b6d

Seen 2026-09-22 to 2026-09-24 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

1.3K

Source IPs

17

Networks

18

Countries

1.7K

Ports hit

3.7K

Events

75

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.875 IPs1.1K
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED229 IPs1.9K
AS396982 Google LLC118 IPs139
AS6939 Hurricane Electric LLC14 IPs16
AS10439 CariNet, Inc.11 IPs110
AS50219 Valence Technology Co.10 IPs125
AS142002 Scloud Pte Ltd6 IPs36
AS14061 DigitalOcean, LLC4 IPs11
AS32475 Internap Holding LLC3 IPs41
AS37963 Hangzhou Alibaba Advertising Co.,Ltd.2 IPs4
AS48090 Techoff Srv Limited1 IPs185
AS198610 Beget LLC1 IPs16

Countries

US 471JP 167DE 166MY 152SG 137HK 82TH 37GB 23NG 19BE 8

Ports targeted

3306/tcp 1213000/tcp 689200/tcp 3810000/tcp 159443/tcp 148080/tcp 148008/tcp 1480/tcp 1410002/tcp 128000/tcp 127777/tcp 129999/tcp 11

What it requests

GET/3.2K
GET/favicon.ico276
HEAD/selfupdate/wuident.cab16
GET/_cat/indices7
GET/_cat/indices?v=true4
GET/.env.tmp2
GET/.env.server2
GET/local_settings.py2
GET/.htpasswd2
GET/.env.temp2
GET/config.php.save2
GET/console/api_server_status2

User agents claimed

curl/7.29.0235 IPs1.9K
curl/7.64.1876 IPs1.1K
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3624 IPs276
curl/8.5.03 IPs203
curl/7.68.0111 IPs135
Source IPCCNetwork Last seenEvents
93.123.109.214BGAS48090 Techoff Srv Limited2026-09-23185
203.55.131.3USAS32475 Internap Holding LLC2026-09-2435
216.226.76.30USAS50219 Valence Technology Co.2026-09-2425
71.6.134.204USAS10439 CariNet, Inc.2026-09-2424
152.32.252.233HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2423
165.154.129.74GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2422
216.226.76.10USAS50219 Valence Technology Co.2026-09-2421
165.154.40.42HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2420
216.226.77.10USAS50219 Valence Technology Co.2026-09-2420
165.154.172.223USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2420
152.32.235.69USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2420
71.6.134.232USAS10439 CariNet, Inc.2026-09-2418
101.36.124.220HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418
152.32.235.160USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418
216.226.77.20USAS50219 Valence Technology Co.2026-09-2417
165.154.41.205HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2417
165.154.173.226USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2417
152.32.226.8HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416
165.154.11.202NGAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416
123.58.213.117HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun030_00000049_03330a18same header set4 IPs41.8Ka10cun030_00000049_54d07b6dsame header set3 IPs24a10cun041_00000049_8cf638c8same header set1 IPs3a11cun030_00000049_0a773432same header set2 IPs2a11cun040_0000004d_aa48e2c81 header apart2.2K IPs40.5Ka10cun020_00000041_0a8d7f111 header apart1.5K IPs26.9Ka11cun040_0000004d_4110f1561 header apart15 IPs8.2Ka11cun040_0000004b_4c87b06e1 header apart134 IPs2.3K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.